What the law says, block by block, jurisdiction by jurisdiction.

The Handbook is the law on data subject access requests, by jurisdiction, in ten fixed blocks with the article or the case number under each one. Ten blocks per jurisdiction, the same ten every time, so the comparison below is generated from the pages rather than written beside them. Each block carries its primary sources, and a block that carries none says so.

A record is written the same way every time: ten blocks, in a fixed order, each stating what the law says on one question and citing the article or the case number under it. That shape is what makes the comparison at the foot of this page possible, because a cell in the table is read from the block on the record rather than written beside it, and it is what lets a practitioner holding a request in one jurisdiction read the same question answered in another. A block that could not be traced to a source says so on the page, and a record no practitioner has reviewed carries a draft notice until one has.

One jurisdiction is published today, the European Union baseline. A national record is added only when a practitioner who works in that jurisdiction has reviewed it block by block, because a record summarised without one would look exactly as authoritative as this one and would not be.

European Union
Updated 22 Sep 2026 · Reviewed 6 Sep 2026
The baseline every other record in the Handbook is measured against: Articles 12 and 15 of the General Data Protection Regulation, and what the Court of Justice has held they mean.
The Regulation itself, read block by block: the article that grants the right, the month and its extension, when a fee or a refusal is allowed, what may be asked to confirm identity, what a copy is, how other people's data is handled, the places the Regulation limits the right, which authority a complaint goes to, and the words Article 4 defines. Every block cites the article or the case number it rests on, and the Court of Justice's holdings on the copy, the first copy and the recipients are stated rather than summarised. A national record is read against this one, and the block on what is different here says so.
Read the record

Reference / The HandbookFour blocks compared · Sheet 02 of 02 · Updated 19 Sep 2026

Compared

The four blocks a request turns on first. The other six are on each record's own page.

Jurisdiction	Deadline and extension	Fees and refusal	The copy	Other people and their data
European Union	One month from receipt, extendable by two further months for complexity or number of requests.	Free of charge. A fee or a refusal only for a manifestly unfounded or excessive request, and the controller carries the burden of showing it is one.	A faithful and intelligible reproduction of the personal data, which can require whole documents where context is what makes the data intelligible.	Article 15(4): the copy must not adversely affect the rights and freedoms of others, and Recital 63 says that is not a ground to withhold everything.

European Union

Compared

Primary sources